couchdb-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Curt Arnold <carn...@apache.org>
Subject Dependencies in SVN
Date Thu, 06 Aug 2009 04:45:52 GMT
The CouchDB now has at least snapshots of three non-ASL licensed, non- 
ASF developed projects in the SVN.  The following message suggests  
that mochiweb in the CouchDB repo is forked and incompatible with the  
main distribution:

http://mail-archives.apache.org/mod_mbox/couchdb-user/200907.mbox/%3C000001ca0dbe$72ac9220$5805b660$@grice@logosworld.com%3E

Having an external code base in the SVN is an invitation to fork which  
results in the ASF effectively publishing software under a license  
other the the ASL v2.  That is a whole different animal than having a  
dependency on an non-ASL'd licensed piece of software.

erlang-oauth was introduced into the SVN yesterday to support the  
couch_http_oauth authentication handler.  It is optional, the recently  
added oauth authentication handler would fail to load without it but  
that should be all.  There was no mention that the patch included  
third-party developed software, no dev list discussion or vote or  
Incubator PMC clearance.  I have requested that it be removed from the  
SVN pending review.

ibrowse was added initially added to the SVN in January and is an HTTP  
client used in replication.  I was unable to find any mailing list  
discussion or Incubator review on the addition of this code base.

mochiweb was added in March 2008 and provides the http server included  
in CouchDB.  The Incubator PMC was aware of this dependency based on  
the April 2008 Incubator PMC board report.  In addition to the http  
server, CouchDB also uses mochiweb routines for parsing query strings,  
url encoding, etc.

Most of the other dependencies are used in the Futon management client.

To minimize the amount of effort that a user has to perform to satisfy  
their license issues, I think we should consider modularizing couchdb  
so that a user who isn't interested in OAuth does not have to research  
its license, etc.

I'd see the parts as:

core: The database and non-network core of CouchDB.  I would hope this  
code have no dependencies other than OTP.

http: The http server dependent on MochiWeb's http services and core.

replicator: dependent on core and ibrowse

futon: HTTP admin console

oauth: OAuth authenticator, dependent on erlang-oauth

Ideally, the interfaces with mochiweb, ibrowse and the like should be  
designed so that other providers could be substituted without huge  
effort.

I do think the Incubator PMC should review the situation, but it would  
be good to understand the issues and discuss a path forward before  
asking for review.

Mime
View raw message